CVE-2026-28324 Overview
CVE-2026-28324 is an unauthenticated remote code execution vulnerability in SolarWinds Observability Self-Hosted. The flaw stems from insufficient integrity checks and affects installations configured in a non-default, non-secure configuration. An unauthenticated attacker with network access can execute arbitrary code on affected systems. The weakness is classified as [CWE-345] Insufficient Verification of Data Authenticity.
Critical Impact
An unauthenticated attacker on the network can achieve remote code execution against SolarWinds Observability Self-Hosted instances running in a non-secure configuration, leading to full system compromise.
Affected Products
- SolarWinds Observability Self-Hosted (installations in non-default, non-secure configurations)
- SolarWinds Orion Platform components deployed under Observability Self-Hosted
- SolarWinds Web Performance Monitor (WPM) location components as referenced in the advisory
Discovery Timeline
- 2026-09-22 - CVE-2026-28324 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-28324
Vulnerability Analysis
SolarWinds Observability Self-Hosted fails to enforce sufficient integrity checks on data or components it processes. When the product runs in a non-default, non-secure configuration, an unauthenticated network attacker can leverage this gap to introduce untrusted content that the platform executes. The impact is remote code execution in the context of the SolarWinds service, which typically runs with elevated privileges on the host. Successful exploitation can lead to lateral movement across monitored infrastructure, given the platform's broad visibility into enterprise environments.
Root Cause
The root cause is insufficient verification of data authenticity, tracked as [CWE-345]. The application does not adequately validate the origin or integrity of inputs it consumes, allowing an attacker to supply content that is trusted and acted upon. The exposure only manifests when the deployment deviates from the vendor's recommended secure configuration.
Attack Vector
The attack is executed over the network without authentication or user interaction. An attacker reaches a vulnerable Observability Self-Hosted instance, submits crafted content that bypasses integrity validation, and triggers code execution on the server. Because the flaw is exposed pre-authentication, any accessible instance running in the vulnerable configuration is at risk. Detailed exploitation mechanics have not been publicly released; refer to the SolarWinds Security Advisory CVE-2026-28324 for vendor-supplied technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-28324
Indicators of Compromise
- Unexpected child processes spawned by SolarWinds Observability or Orion service accounts, particularly command shells, scripting engines, or certutil/bitsadmin execution.
- New or modified files in SolarWinds installation directories that were not deployed by an authorized upgrade or patch cycle.
- Outbound connections from the Observability Self-Hosted server to unfamiliar IP addresses or domains shortly after inbound HTTP/HTTPS traffic.
Detection Strategies
- Alert on process lineage where SolarWinds service processes create interactive shells, PowerShell, or LOLBins commonly abused for post-exploitation.
- Monitor web server and application logs on the Observability Self-Hosted host for anomalous request patterns targeting update, plugin, or agent endpoints referenced in the vendor advisory.
- Correlate file integrity monitoring events on SolarWinds binaries and configuration files with authentication and network telemetry to identify tampering.
Monitoring Recommendations
- Ingest SolarWinds application, IIS, and Windows Security event logs into a centralized SIEM for retention and correlation.
- Enable command-line auditing and PowerShell script block logging on hosts running Observability Self-Hosted.
- Track outbound egress from the Observability server and treat any non-baseline destination as a high-priority investigation.
How to Mitigate CVE-2026-28324
Immediate Actions Required
- Upgrade SolarWinds Observability Self-Hosted to version 2026.2.3 or later per the SolarWinds Release Notes 2026.2.3.
- Audit deployments against the SolarWinds Secure Configuration Guide and remediate any non-default, non-secure settings.
- Restrict network access to the Observability Self-Hosted management interfaces to trusted administrative networks only.
Patch Information
SolarWinds addressed CVE-2026-28324 in the 2026.2.3 release of Observability Self-Hosted. Administrators should review the SolarWinds Security Advisory CVE-2026-28324 for authoritative patch and configuration guidance, and confirm that all Orion Platform and WPM components referenced in the advisory are updated accordingly.
Workarounds
- Reconfigure the deployment to the vendor's secure configuration baseline, as the vulnerability only affects non-default, non-secure configurations.
- Place the Observability Self-Hosted server behind network segmentation and a web application firewall to limit unauthenticated exposure until patching completes.
- Follow the guidance in the SolarWinds WPM Location Addition documentation when reviewing agent and location trust boundaries.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
